CVE-2026-39316

OpenPrinting CUPS before version 2.4.20 has a flaw in copy_banner() that uses the attacker-controlled attributes-natural-language value as a directory component. This allows escaping the banner directory and copying an arbitrary file into a spool object that can be delivered to the attacker.

In OpenPrinting CUPS, copy_model() in scheduler/ipp.c creates a predictable TempDir/<connection-number>.ppd path in an lp-group-writable directory and opens it as root without O_EXCL or O_NOFOLLOW. Exploitation requires an lp-group process able to write that directory, predict the connection-derived name, and plant a symlink before the root open, while a privileged add-printer or modify-printer operation using a model PPD triggers copy_model(). Fixed in version 2.4.20.

In OpenPrinting CUPS before 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string values from a configured fax queue to the phone and faxPrefix options. These mapped fax values bypass the control-character sanitizer and are copied directly into the filter options argument, allowing a user permitted to submit a job to inject control characters into the downstream option stream.

In OpenPrinting CUPS before 2.4.20, the quote_string() function in backend/ipp.c preserves carriage-return and line-feed characters in a remote printer-controlled marker-message before report_attr() writes the value to the scheduler status stream. The scheduler can parse an injected newline as a separate PPD control line and persist an attacker-selected PPD keyword.

A NULL pointer dereference in OpenPrinting CUPS before 2.4.20 caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length() calls strlen() on a NULL attribute name, terminating cupsd and disrupting all queues.

A NULL pointer dereference in cupsdCheckJobs() in OpenPrinting CUPS before 2.4.20 when a job marked job-held-on-create refers to a temporary printer that has been automatically deleted. Temporary-printer cleanup can remove the destination without canceling its held jobs, and the scheduler dereferences the NULL result of cupsdFindDest() while checking holding_new_jobs. This terminates cupsd and interrupts all queues.

A double-free in printer-class management in OpenPrinting CUPS before 2.4.20. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass->printers without clearing the pointer. If subsequent validation fails, the class retains the dangling pointer; CUPS-Delete-Class subsequently frees the same allocation in cupsdDeletePrinter(). A client authorized to modify and delete classes can cause scheduler-wide denial of service.

A resource-exhaustion vulnerability in OpenPrinting CUPS through 2.4.20 in the submission-timeout handling of cupsdCheckJobs(). The scheduler suppresses timeout processing for all pending jobs whenever any client connection has an in-flight Send-Document operation, without matching that connection to the job being examined. A client allowed to reach the IPP service can hold an incomplete HTTP request containing parsed Send-Document headers before operation authorization, preventing unrelated incomplete jobs from expiring.

OpenPrinting CUPS versions 2.4.16 and prior contain an integer underflow in _ppdCreateFromIPP() (cups/ppd-cache.c). Any unprivileged local user can crash the root cupsd process by supplying a negative job-password-supported IPP attribute. The value passes validation, is cast to size_t (wrapping to ~2^64), and is used as the length argument to memset() on a 33-byte stack buffer, causing an immediate SIGSEGV. Combined with systemd's Restart=on-failure, an attacker can repeat the crash for sustained denial of service.

In OpenPrinting CUPS before version 2.4.15, a user in the lpadmin group can use the web UI to change the config and insert a malicious line. The cupsd process running as root parses the new config, causing an out-of-bounds write.